Skip to content
Noroxi

CWE-538 · 86 records

Insertion of Sensitive Information into Externally-Accessible File or Directory

CVEs in this class

87 records

  • CVE-2019-6851
    39Monitor

    A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (al

    HighCVSS 7.5No exploitEPSS 29%

    schneider-electric · modicon m580 firmwareOct 29, 2019

  • CVE-2024-22433
    39Monitor

    Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in

    CriticalCVSS 9.8No exploitEPSS 1%

    dell · data protection searchFeb 6, 2024

  • CVE-2025-12059
    39Monitor

    Improper Access Control in Logo Software's Logo j-Platform

    CriticalCVSS 9.8No exploitEPSS 0%

    logo software industry and trade inc. · logo j-platformFeb 11, 2026

  • CVE-2023-5003
    38Monitor

    Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure

    HighCVSS 7.5Proof of conceptEPSS 26%

    miniorange · active directory integration \/ ldap integrationOct 16, 2023

  • CVE-2016-20024
    37Monitor

    ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation

    CriticalCVSS 9.3No exploitEPSS 1%

    zkteco inc. · zkteco zktime.netMar 16, 2026

  • CVE-2026-44828
    37Monitor

    Qexo initialization endpoint can reset setup state and expose stored credentials

    CriticalCVSS 9.3No exploitEPSS 0%

    qexo · qexo2 days ago

  • CVE-2024-51977
    35Monitor

    Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Kon

    MediumCVSS 5.3WeaponizedEPSS 47%

    brother industries, ltd · hl-l8260cdnJun 25, 2025

  • CVE-2026-49298
    35Monitor

    Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

    HighCVSS 8.8No exploitEPSS 1%

    apache · airflowJun 1, 2026

  • CVE-2023-7062
    35Monitor

    Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal

    HighCVSS 8.8No exploitEPSS 1%

    advanced file manager · advanced file manager shortcodesJul 9, 2024

  • CVE-2019-15793
    35Monitor

    Mishandling of file-system uid/gid with namespaces in shiftfs

    HighCVSS 8.8Proof of conceptEPSS 1%

    linux · linux kernelApr 23, 2020

  • CVE-2026-21672
    35Monitor

    A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

    HighCVSS 8.8No exploitEPSS 0%

    veeam · backup and replicationMar 12, 2026

  • CVE-2021-4471
    34Monitor

    TG8 Firewall Unauthenticated User Password Disclosure

    HighCVSS 8.7No exploitEPSS 1%

    tg8 · tg8 firewallNov 14, 2025

  • CVE-2020-37104
    34Monitor

    ASTPP 4.0.1 VoIP Billing - Database Backup Download

    HighCVSS 8.7No exploitEPSS 1%

    inextrix · astppFeb 11, 2026

  • CVE-2016-15056
    34Monitor

    Ubee EVW3226 Unauthenticated Backup File Disclosure

    HighCVSS 8.7No exploitEPSS 1%

    ubee interactive · ubee evw3226Nov 14, 2025

  • CVE-2019-25706
    34Monitor

    Across DR-810 ROM-0 Unauthenticated File Disclosure

    HighCVSS 8.7No exploitEPSS 1%

    across · dr-810Apr 12, 2026

  • CVE-2026-23838
    34Monitor

    Tandoor Recipes module allows SQLite database to be externally accessible with the default settings

    HighCVSS 8.7No exploitEPSS 1%

    nixos · nixpkgsJan 19, 2026

  • CVE-2023-54346
    34Monitor

    WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

    HighCVSS 8.7No exploitEPSS 0%

    backupbliss · wordpress plugin backup migrationMay 5, 2026

  • CVE-2026-27173
    34Monitor

    Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

    HighCVSS 8.7No exploitEPSS 0%

    apache · apache-airflow-providers-cncf-kubernetesMay 19, 2026

  • CVE-2022-4318
    31Monitor

    Cri-o: /etc/passwd tampering privesc

    HighCVSS 7.8No exploitEPSS 0%

    kubernetes · cri-oSep 25, 2023

  • CVE-2021-40363
    31Monitor

    A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All version

    HighCVSS 7.8No exploitEPSS 0%

    siemens · simatic pcs 7Feb 9, 2022

  • CVE-2016-10399
    30Monitor

    Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read

    HighCVSS 7.5No exploitEPSS 1%

    sendio · sendioJul 27, 2017

  • CVE-2022-44623
    30Monitor

    In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings

    HighCVSS 7.5No exploitEPSS 1%

    jetbrains · teamcityNov 3, 2022

  • CVE-2026-15574
    30Monitor

    Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default

    HighCVSS 7.5No exploitEPSS 0%

    red hat · red hat openshift ai (rhoai)Jul 13, 2026

  • CVE-2023-46723
    30Monitor

    lte-pic32-writer's sendto.txt may disclose URL and the API key

    HighCVSS 7.5No exploitEPSS 0%

    pajip · lte-pic32-writerOct 31, 2023

  • CVE-2025-61138
    30Monitor

    Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.

    HighCVSS 7.5No exploitEPSS 0%

    qlik · qlik senseNov 20, 2025

All vulnerability classes